diff --git a/.github/rulesets/main.json b/.github/rulesets/main.json
new file mode 100644
index 0000000..f31c72f
--- /dev/null
+++ b/.github/rulesets/main.json
@@ -0,0 +1,37 @@
+{
+  "name": "main",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_review_thread_resolution": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": ["merge"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [{ "context": "ci" }]
+      }
+    }
+  ]
+}
diff --git a/.github/rulesets/tags.json b/.github/rulesets/tags.json
new file mode 100644
index 0000000..9f0d064
--- /dev/null
+++ b/.github/rulesets/tags.json
@@ -0,0 +1,13 @@
+{
+  "name": "release-tags",
+  "target": "tag",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/v*"],
+      "exclude": []
+    }
+  },
+  "rules": [{ "type": "deletion" }, { "type": "non_fast_forward" }]
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 43b69ec..e4732c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -309,8 +309,12 @@ jobs:
           cat "$HOME/plugins.txt"
           grep -q 'omp-codebase-memory' "$HOME/plugins.txt"
 
-  # The single status check branch protection requires. Runtime jobs are never
-  # named there, so changing the matrix never means editing the ruleset.
+  # The single status check branch protection requires. `.github/rulesets/main.json`
+  # names the literal string `ci`; nothing mechanically verifies the two agree, so
+  # renaming this job silently blocks every merge with no failing job to point at.
+  #
+  # Runtime jobs are never named there. Adding, removing, or restructuring one
+  # means editing this job's `needs` and nothing else.
   ci:
     name: ci
     needs: [hygiene, bun]